ramnit | 679a4974ab63899ed62e52788c391369675a904adc969c93d4ec274dada141d2

Analysis

max time kernel
168s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59fa728668cadc67f6c031e08cf7d203.exe
Size 193KB
Sample240114-cdg6eabab9
SHA256 679a4974ab63899ed62e52788c391369675a904adc969c93d4ec274dada141d2
MD5 59fa728668cadc67f6c031e08cf7d203
SHA1 6fe6f0f77504d02560e2ce3cea79e01dc8dc1c8e
SHA512 9e273dc3707de2a13e58d78bb6f5694493886f88ffc1a5893fd7290be509be56439cd8d31c247d7bf72ad9a2f650af4dca84d5eaf175687572b347a3e967318b
SSDEEP 3072:pR2xn3k0CdM1vabyzJYWqSSpbaxhptgiHaKruj3A3dS5DFZSHZFD:pR2J0LS6VTI/fjaHQ31V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

pid	Process
4888	59fa728668cadc67f6c031e08cf7d203mgr.exe
644	WaterMark.exe
1620	WaterMarkmgr.exe
700	WaterMark.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4888-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4888-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1832-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1620-35-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/1620-47-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/644-49-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/700-52-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral2/memory/700-60-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/700-63-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/644-69-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral2/memory/644-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/644-74-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/700-75-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral2/memory/700-76-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/644-77-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	59fa728668cadc67f6c031e08cf7d203.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	59fa728668cadc67f6c031e08cf7d203.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE86C.tmp	59fa728668cadc67f6c031e08cf7d203mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE85C.tmp	59fa728668cadc67f6c031e08cf7d203.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	59fa728668cadc67f6c031e08cf7d203mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE9C4.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
380	1120	WerFault.exe	94
4928	4632	WerFault.exe	93

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5C5F5721-B280-11EE-9A4E-DE9D3A49EF0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "828627679"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "828627679"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "830190935"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "858471794"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "858628038"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5C4C4A18-B280-11EE-9A4E-DE9D3A49EF0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "870346929"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "828315765"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411962465"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "832222548"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082125"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "858471794"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5C5F7E31-B280-11EE-9A4E-DE9D3A49EF0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "832222548"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
644	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe
700	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	WaterMark.exe
Token: SeDebugPrivilege	700	WaterMark.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3372	iexplore.exe
2212	iexplore.exe
2800	iexplore.exe
3096	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3096	iexplore.exe
3096	iexplore.exe
3372	iexplore.exe
3372	iexplore.exe
2800	iexplore.exe
2800	iexplore.exe
3688	IEXPLORE.EXE
3688	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
4576	IEXPLORE.EXE
4576	IEXPLORE.EXE
688	IEXPLORE.EXE
688	IEXPLORE.EXE

Suspicious use of UnmapMainImage 5 IoCs

pid	Process
4888	59fa728668cadc67f6c031e08cf7d203mgr.exe
1832	59fa728668cadc67f6c031e08cf7d203.exe
644	WaterMark.exe
1620	WaterMarkmgr.exe
700	WaterMark.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4888	1832	59fa728668cadc67f6c031e08cf7d203.exe	88
PID 1832 wrote to memory of 4888	1832	59fa728668cadc67f6c031e08cf7d203.exe	88
PID 1832 wrote to memory of 4888	1832	59fa728668cadc67f6c031e08cf7d203.exe	88
PID 1832 wrote to memory of 644	1832	59fa728668cadc67f6c031e08cf7d203.exe	91
PID 1832 wrote to memory of 644	1832	59fa728668cadc67f6c031e08cf7d203.exe	91
PID 1832 wrote to memory of 644	1832	59fa728668cadc67f6c031e08cf7d203.exe	91
PID 644 wrote to memory of 1620	644	WaterMark.exe	90
PID 644 wrote to memory of 1620	644	WaterMark.exe	90
PID 644 wrote to memory of 1620	644	WaterMark.exe	90
PID 1620 wrote to memory of 700	1620	WaterMarkmgr.exe	92
PID 1620 wrote to memory of 700	1620	WaterMarkmgr.exe	92
PID 1620 wrote to memory of 700	1620	WaterMarkmgr.exe	92
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 644 wrote to memory of 1120	644	WaterMark.exe	94
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 4632	700	WaterMark.exe	93
PID 700 wrote to memory of 3372	700	WaterMark.exe	104
PID 700 wrote to memory of 3372	700	WaterMark.exe	104
PID 644 wrote to memory of 3096	644	WaterMark.exe	105
PID 644 wrote to memory of 3096	644	WaterMark.exe	105
PID 644 wrote to memory of 2800	644	WaterMark.exe	106
PID 644 wrote to memory of 2800	644	WaterMark.exe	106
PID 700 wrote to memory of 2212	700	WaterMark.exe	107
PID 700 wrote to memory of 2212	700	WaterMark.exe	107
PID 2212 wrote to memory of 688	2212	iexplore.exe	108
PID 2212 wrote to memory of 688	2212	iexplore.exe	108
PID 2212 wrote to memory of 688	2212	iexplore.exe	108
PID 3096 wrote to memory of 3688	3096	iexplore.exe	109
PID 3096 wrote to memory of 3688	3096	iexplore.exe	109
PID 3096 wrote to memory of 3688	3096	iexplore.exe	109
PID 3372 wrote to memory of 4576	3372	iexplore.exe	110
PID 3372 wrote to memory of 4576	3372	iexplore.exe	110
PID 3372 wrote to memory of 4576	3372	iexplore.exe	110
PID 2800 wrote to memory of 2316	2800	iexplore.exe	111
PID 2800 wrote to memory of 2316	2800	iexplore.exe	111
PID 2800 wrote to memory of 2316	2800	iexplore.exe	111

C:\Users\Admin\AppData\Local\Temp\59fa728668cadc67f6c031e08cf7d203.exe
"C:\Users\Admin\AppData\Local\Temp\59fa728668cadc67f6c031e08cf7d203.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\59fa728668cadc67f6c031e08cf7d203mgr.exe
  C:\Users\Admin\AppData\Local\Temp\59fa728668cadc67f6c031e08cf7d203mgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:4888
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 212
      4⤵
      Program crash
      PID:380
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3096 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3688
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2316

C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 204
      4⤵
      Program crash
      PID:4928
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3372 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4576
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1120 -ip 1120
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4632 -ip 4632
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WaterMark.exe

Path C:\Program Files (x86)\Microsoft\WaterMark.exe
Size 193KB
SHA256 679a4974ab63899ed62e52788c391369675a904adc969c93d4ec274dada141d2
MD5 59fa728668cadc67f6c031e08cf7d203
SHA1 6fe6f0f77504d02560e2ce3cea79e01dc8dc1c8e
SHA512 9e273dc3707de2a13e58d78bb6f5694493886f88ffc1a5893fd7290be509be56439cd8d31c247d7bf72ad9a2f650af4dca84d5eaf175687572b347a3e967318b
SSDEEP 3072:pR2xn3k0CdM1vabyzJYWqSSpbaxhptgiHaKruj3A3dS5DFZSHZFD:pR2J0LS6VTI/fjaHQ31V
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{5C4C4A18-B280-11EE-9A4E-DE9D3A49EF0E}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5C4C4A18-B280-11EE-9A4E-DE9D3A49EF0E}.dat
Size 3KB
SHA256 aeecb72bf842ca0d55b1a3f7e621e13703a5d0f5dc774623c662cb2c551e77b9
MD5 4591b1d2acdd6a8c1d9e4ff1a14a1d7e
SHA1 6d89dfc62cd877bea0c834d64e2285ecfe166151
SHA512 5d2439550bdb917959c36cc5f9fa0319eadacc7b7f86a3784ee7683eaca41832917c7c48385df3792c8264dfc42ace87ca0d25d79fdc2db2b110e83b525df655
MD5 SHA1 SHA512

Submit Download

RecoveryStore.{5C5A92DB-B280-11EE-9A4E-DE9D3A49EF0E}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5C5A92DB-B280-11EE-9A4E-DE9D3A49EF0E}.dat
Size 4KB
SHA256 4e473075dd4cd9c569a55a7b09f361e818cc228edfc5f587ca96651c90cc4a39
MD5 c0de8f18b003472c1ce957c52b83c282
SHA1 f8948b80d2eef030ab2c9344ed816ddd72fad245
SHA512 2badb7581b52ca75d78c9d6364339253a4a43416efde1a832c6fc4ef1a72059b3ccea86a05d6723ab49377869a32fac13b7d57310ad9dbb017590c53bb1c6f54
SSDEEP 12:rlfFqLrEgm8Gj76FFDrEgmf+IaCyoqw9lTqKHw/UC9lTqKHw/c12:reLG8ZGv/99lWKHwUC9lWKHwc12
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{5C5F5721-B280-11EE-9A4E-DE9D3A49EF0E}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5C5F5721-B280-11EE-9A4E-DE9D3A49EF0E}.dat
Size 5KB
SHA256 dd8302fd8bbf21a86bb3b71079b12f535efd74dcfc46c378d8394deb89c63bd6
MD5 186ecc03ea7b20a17065b939c806eff6
SHA1 1a4f4d6f11c40053b3490b398c9033467e9cf3f4
SHA512 c9db12baafd2b22ad5b5ae90a469a722af82da9597e381b64bf828d08b3f6f0208237e40a22875989f11f4b2be570307bacd151fb6d4af42f10ca1f56fb15451
SSDEEP 24:rwGo/Qez1AGo/Kz1tz1879lWxZtWlsSTS9lWxZtWlsST0T:rwGo4CqGo+z6CxWbnxWbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ver71B0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver71B0.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6AXLYU2E\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

59fa728668cadc67f6c031e08cf7d203mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\59fa728668cadc67f6c031e08cf7d203mgr.exe
Size 95KB
SHA256 ce8e07cec9c3857f48e20916c65413335ab480b0c3d70345e98147b2ff7b8de6
MD5 f8a6e7529ad1b00a18c6ca2702521471
SHA1 2cadb00ca99be622623dc78095f594bedfec7534
SHA512 e1c3f164aa58360e4b664341ddea907fe990fa93de6f1e98b4fe87bf713e62b50191d738afc5591ead628f6f58dead74d78d26267ac03079f96bcb85b93ce2f7
SSDEEP 768:D06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:BR0vxn3Pc0LCH9MtbvabUDzJYWu3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-69-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/644-66-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/644-77-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/644-50-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/644-49-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/644-74-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/644-70-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/644-55-0x0000000077012000-0x0000000077013000-memory.dmp

Download

memory/700-67-0x0000000077012000-0x0000000077013000-memory.dmp

Download

memory/700-75-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/700-52-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/700-76-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/700-60-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/700-59-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/700-63-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1620-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1620-35-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1832-13-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/1832-7-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1832-0-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1832-27-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4632-64-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4632-65-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4888-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4888-5-0x0000000000400000-0x0000000000438000-memory.dmp

Download